{"id":"CVE-2026-53441","aliases":["BIT-jenkins-2026-53441","EUVD-2026-36025","GHSA-93qh-vwrm-c5pw"],"status":"published","title":"Jenkins: Stored XSS vulnerability in node offline cause description","description":"Jenkins 2.483 through 2.567 (both inclusive), LTS 2.492.1 through 2.555.2 (both inclusive) does not escape the user-provided description of a generic offline cause that could be set through the `POST config.xml` API, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure permission.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.0024,"percentile":0.15165,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2026-06-10T13:06:01Z","modified":"2026-10-28T02:30:44Z","fixes":[{"ecosystem":"Maven","package":"org.jenkins-ci.main:jenkins-core","fixed_in":["2.568"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"jenkins","fixed_in":["2.555.3","2.568.0"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.jenkins-ci.main:jenkins-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.483"},{"last_affected":"2.567"},{"fixed":"2.568"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"jenkins","ranges":[{"type":"SEMVER","events":[{"introduced":"2.483.0"},{"fixed":"2.555.3"},{"introduced":"2.556.0"},{"fixed":"2.568.0"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.jenkins-ci.main:jenkins-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.483"},{"fixed":"2.568"}]}],"versions":["2.483","2.484","2.485","2.486","2.487","2.488","2.489","2.490","2.491","2.492","2.492.1","2.492.2","2.492.3","2.493","2.494","2.495","2.496","2.497","2.498","2.499","2.500","2.501","2.502","2.503","2.504","2.504.1","2.504.2","2.504.3","2.505","2.506","2.507","2.508","2.509","2.510","2.511","2.512","2.513","2.514","2.515","2.516","2.516.1","2.516.2","2.516.3","2.517","2.518","2.519","2.520","2.521","2.522","2.523","2.524","2.525","2.526","2.527","2.528","2.528.1","2.528.2","2.528.3","2.529","2.530","2.531","2.532","2.533","2.534","2.535","2.536","2.537","2.538","2.539","2.540","2.541","2.541.1","2.541.2","2.541.3","2.542","2.543","2.544","2.545","2.546","2.547","2.548","2.549","2.550","2.551","2.552","2.553","2.554","2.555","2.555.1","2.555.2","2.555.3","2.556","2.557","2.558","2.559","2.560","2.561","2.562","2.563","2.564","2.565","2.566","2.567"]}],"products":[{"vendor":"jenkins","product":"jenkins"},{"vendor":"jenkins project","product":"jenkins"}],"references":[{"url":"https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3731","tags":["vendor-advisory","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53441","tags":["web","advisory"]},{"url":"https://github.com/jenkinsci/jenkins/commit/20041e8090d3b228d586169141ea7f12ffe4444d","tags":["web"]},{"url":"https://github.com/advisories/GHSA-93qh-vwrm-c5pw"},{"url":"https://github.com/jenkinsci/jenkins","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-53441","description":"Jenkins 2.483 through 2.567 (both inclusive), LTS 2.492.1 through 2.555.2 (both inclusive) does not escape the user-provided description of a generic offline cause that could be set through the `POST config.xml` API, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure permission.","status":"published","published":"2026-06-10T13:06:01.921Z","modified":"2026-07-06T14:37:58.583Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:20:00.11477Z"}],"euvd":[{"id":"EUVD-2026-36025","description":"Jenkins 2.483 through 2.567 (both inclusive), LTS 2.492.1 through 2.555.2 (both inclusive) does not escape the user-provided description of a generic offline cause that could be set through the `POST config.xml` API, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure permission.","status":"published","published":"2026-06-10T13:06:01Z","modified":"2026-07-06T14:37:58Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:20:13.172179Z"}],"ghsa":[{"id":"GHSA-93qh-vwrm-c5pw","title":"Jenkins: Stored XSS vulnerability in node offline cause description ","description":"Jenkins 2.483 through 2.567 (both inclusive), LTS 2.492.1 through 2.555.2 (both inclusive) does not escape the user-provided description of a generic offline cause that could be set through the `POST config.xml` API, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure permission.","status":"published","published":"2026-06-10T15:31:31Z","modified":"2026-06-12T22:15:37Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:40:27.329706Z"}],"nvd":[{"id":"CVE-2026-53441","description":"Jenkins 2.483 through 2.567 (both inclusive), LTS 2.492.1 through 2.555.2 (both inclusive) does not escape the user-provided description of a generic offline cause that could be set through the `POST config.xml` API, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure permission.","status":"published","published":"2026-06-10T14:16:37.087Z","modified":"2026-10-26T11:10:00.157Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:23.485267Z"}],"osv":[{"id":"CVE-2026-53441","description":"Jenkins 2.483 through 2.567 (both inclusive), LTS 2.492.1 through 2.555.2 (both inclusive) does not escape the user-provided description of a generic offline cause that could be set through the `POST config.xml` API, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure permission.","status":"published","published":"2026-06-10T14:16:37.087Z","modified":"2026-10-28T02:30:44.291301128Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:07.787185Z"},{"id":"GHSA-93qh-vwrm-c5pw","title":"Jenkins: Stored XSS vulnerability in node offline cause description ","description":"Jenkins 2.483 through 2.567 (both inclusive), LTS 2.492.1 through 2.555.2 (both inclusive) does not escape the user-provided description of a generic offline cause that could be set through the `POST config.xml` API, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure permission.","status":"published","published":"2026-06-10T15:31:31Z","modified":"2026-09-10T03:50:49.073627583Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:43.123867Z"},{"id":"BIT-jenkins-2026-53441","description":"Jenkins 2.483 through 2.567 (both inclusive), LTS 2.492.1 through 2.555.2 (both inclusive) does not escape the user-provided description of a generic offline cause that could be set through the `POST config.xml` API, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure permission.","status":"published","published":"2026-06-13T08:41:31.56Z","modified":"2026-09-10T16:01:12.113780704Z","updated_at":"2026-11-02T15:28:31.782692Z"}]}}